Correlate the machine against the network and defend the escalate decision

applied · 50 min · Objective 3.3

Task

Produce evidence from two independent sources -- the machine and the network it sits on -- and reach a clean, rebuild or escalate decision that survives being questioned. The correlation is the point: the strongest evidence available is a connection the network saw and the machine denies.

Steps

  1. Write a small harmless program of your own on the guest that makes a periodic outbound connection within your own lab network, and record what it does in lab/correlate/program.md.
  2. Record what the machine reports about its own connections in lab/correlate/machine.csv with header time,destination,port,process.
  3. Record what your own router, firewall or a second machine on the same segment saw, in lab/correlate/network.csv with the same header.
  4. Compare the two and record every discrepancy in lab/correlate/discrepancies.csv with header observation,seen_by_machine,seen_by_network,significance.
  5. Write lab/correlate/decision.md giving clean, rebuild or escalate with the criteria that decided it, including whether you could establish how the program arrived.

Verify

grep -Ec '^[-*#0-9A-Za-z]' lab/correlate/program.md
awk -F, 'NR>1 && NF>=4 {n++} END {print n" machine observation(s)"}' lab/correlate/machine.csv
awk -F, 'NR>1 && NF>=4 {n++} END {print n" network observation(s)"}' lab/correlate/network.csv
awk -F, 'NR>1 && NF>=4 {n++} END {print n" discrepanc(ies) assessed"}' lab/correlate/discrepancies.csv
grep -Eic 'clean|rebuild|escalate' lab/correlate/decision.md
grep -Eic 'how it arrived|route in|unexplained' lab/correlate/decision.md

Observations from both sources, discrepancies assessed, and a decision that addresses whether the route in was established. A decision with no such clause is missing the criterion that usually settles it.

Notes

An unexplained infection is an unclosed route. That clause is the one people argue with, and it is the one that most often makes rebuild the right answer even when cleaning appears to have worked.

This is an independent study companion for CompTIA A+ Core 2 220-1202 and is not produced by or endorsed by CompTIA.